CVE-2026-41187 Calico Tier Authorization Bypass via DeleteCollection
Attackers with deletecollection permissions can bypass tier authorization to bulk-delete network policies in unauthorized tiers, compromising network segmentation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41187?
CVE-2026-41187 is a medium-severity missing authorization vulnerability in Tigera Calico, published on 30 Jul 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not invoked for DeleteCollection requests. A user holding the deletecollection verb or wildcard verbs on tier-scoped policy resources can bulk-delete policies in tiers they otherwise have no rights on, breaking the tier authorization boundary.
Which versions are affected by CVE-2026-41187?
It affects 1 product.
Products include Tigera Calico.
How do I fix CVE-2026-41187?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-41187 being exploited?
There is no known exploitation of CVE-2026-41187 in the wild and no public exploit code.
Other vulnerabilities in Tigera Calico
- CVE-2026-6540 L7 policy bypass via unnormalized HTTP path matching
- CVE-2026-41186 Unauthenticated Go pprof exposure in Calico debug server
- CVE-2026-41184 ServiceAccount token disclosure via install-cni container logs
- CVE-2026-41185 ServiceAccount token disclosure via Azure IPAM CNI plugin logs
- CVE-2022-28224 Calico and Calico Enterprise may be vulnerable to route hijacking with the floating IP feature
Sources
Also known as GHSA-38w4-qxg9-xg36, MINI-3mmh-24jq-3q2c, MINI-7795-vxv8-gq89, MINI-7v2v-qpww-5x6r, MINI-gfjx-66hv-vmw9, MINI-jvgj-h44q-4mj3 and 3 more.